Overview

overview

8

Static

static

1

UGEEWin_4....05.exe

windows10-2004-x64

4

UGEEWin_4....05.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    UGEEWin_4.3.6.250305.exe
  • Size 25.1MB
  • Sample260629-xp1r4sc151
  • SHA256 15a430a32f931de3b975bd969f3d687f872d4dbda7b9aa15580536a08c89e760
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerpersistence

Malware Config

Signatures

  • Drops file in Drivers directory 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 56 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UGEEWin_4.3.6.250305.exe
    "C:\Users\Admin\AppData\Local\Temp\UGEEWin_4.3.6.250305.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\is-NB88N.tmp\UGEEWin_4.3.6.250305.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NB88N.tmp\UGEEWin_4.3.6.250305.tmp" /SL5="$501FC,25721763,247296,C:\Users\Admin\AppData\Local\Temp\UGEEWin_4.3.6.250305.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5764
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\EndWintab.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:924
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im PenTablet.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3356
        • C:\Windows\system32\taskkill.exe
          taskkill /f /t /im PentabletService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1780
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c listdlls.exe -d wintab32.dll /accepteula
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1276
          • C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\Listdlls.exe
            listdlls.exe -d wintab32.dll /accepteula
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4144
            • C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\Listdlls64.exe
              listdlls.exe -d wintab32.dll /accepteula
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5584
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Listdlls v3.2 - Listdlls "
          4⤵
            PID:5520
          • C:\Windows\system32\find.exe
            find "pid:"
            4⤵
              PID:4392
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Copyright (C) 1997-2016 Mark Russinovich "
              4⤵
                PID:2744
              • C:\Windows\system32\find.exe
                find "pid:"
                4⤵
                  PID:4648
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Sysinternals "
                  4⤵
                    PID:2788
                  • C:\Windows\system32\find.exe
                    find "pid:"
                    4⤵
                      PID:2264
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening System(4): "
                      4⤵
                        PID:6084
                      • C:\Windows\system32\find.exe
                        find "pid:"
                        4⤵
                          PID:4996
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                          4⤵
                            PID:244
                          • C:\Windows\system32\find.exe
                            find "pid:"
                            4⤵
                              PID:236
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening Registry(96): "
                              4⤵
                                PID:1412
                              • C:\Windows\system32\find.exe
                                find "pid:"
                                4⤵
                                  PID:2448
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                  4⤵
                                    PID:1152
                                  • C:\Windows\system32\find.exe
                                    find "pid:"
                                    4⤵
                                      PID:2804
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening smss.exe(452): "
                                      4⤵
                                        PID:4168
                                      • C:\Windows\system32\find.exe
                                        find "pid:"
                                        4⤵
                                          PID:2976
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                          4⤵
                                            PID:5836
                                          • C:\Windows\system32\find.exe
                                            find "pid:"
                                            4⤵
                                              PID:4748
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening csrss.exe(612): "
                                              4⤵
                                                PID:5468
                                              • C:\Windows\system32\find.exe
                                                find "pid:"
                                                4⤵
                                                  PID:6012
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                  4⤵
                                                    PID:1700
                                                  • C:\Windows\system32\find.exe
                                                    find "pid:"
                                                    4⤵
                                                      PID:4756
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening wininit.exe(684): "
                                                      4⤵
                                                        PID:3628
                                                      • C:\Windows\system32\find.exe
                                                        find "pid:"
                                                        4⤵
                                                          PID:3640
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                          4⤵
                                                            PID:4752
                                                          • C:\Windows\system32\find.exe
                                                            find "pid:"
                                                            4⤵
                                                              PID:2636
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening csrss.exe(692): "
                                                              4⤵
                                                                PID:4236
                                                              • C:\Windows\system32\find.exe
                                                                find "pid:"
                                                                4⤵
                                                                  PID:2800
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                  4⤵
                                                                    PID:3068
                                                                  • C:\Windows\system32\find.exe
                                                                    find "pid:"
                                                                    4⤵
                                                                      PID:2908
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening services.exe(816): "
                                                                      4⤵
                                                                        PID:3176
                                                                      • C:\Windows\system32\find.exe
                                                                        find "pid:"
                                                                        4⤵
                                                                          PID:5524
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                          4⤵
                                                                            PID:2200
                                                                          • C:\Windows\system32\find.exe
                                                                            find "pid:"
                                                                            4⤵
                                                                              PID:2220
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening lsass.exe(832): "
                                                                              4⤵
                                                                                PID:5328
                                                                              • C:\Windows\system32\find.exe
                                                                                find "pid:"
                                                                                4⤵
                                                                                  PID:4432
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                  4⤵
                                                                                    PID:1456
                                                                                  • C:\Windows\system32\find.exe
                                                                                    find "pid:"
                                                                                    4⤵
                                                                                      PID:5600
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(1400): "
                                                                                      4⤵
                                                                                        PID:3904
                                                                                      • C:\Windows\system32\find.exe
                                                                                        find "pid:"
                                                                                        4⤵
                                                                                          PID:932
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                          4⤵
                                                                                            PID:3224
                                                                                          • C:\Windows\system32\find.exe
                                                                                            find "pid:"
                                                                                            4⤵
                                                                                              PID:3544
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(3368): "
                                                                                              4⤵
                                                                                                PID:2968
                                                                                              • C:\Windows\system32\find.exe
                                                                                                find "pid:"
                                                                                                4⤵
                                                                                                  PID:1144
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                  4⤵
                                                                                                    PID:2980
                                                                                                  • C:\Windows\system32\find.exe
                                                                                                    find "pid:"
                                                                                                    4⤵
                                                                                                      PID:1632
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening SecurityHealthService.exe(5276): "
                                                                                                      4⤵
                                                                                                        PID:5440
                                                                                                      • C:\Windows\system32\find.exe
                                                                                                        find "pid:"
                                                                                                        4⤵
                                                                                                          PID:3268
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                          4⤵
                                                                                                            PID:6056
                                                                                                          • C:\Windows\system32\find.exe
                                                                                                            find "pid:"
                                                                                                            4⤵
                                                                                                              PID:1568
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening sppsvc.exe(5780): "
                                                                                                              4⤵
                                                                                                                PID:5984
                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                find "pid:"
                                                                                                                4⤵
                                                                                                                  PID:5648
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                                  4⤵
                                                                                                                    PID:2660
                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                    find "pid:"
                                                                                                                    4⤵
                                                                                                                      PID:1076
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(1164): "
                                                                                                                      4⤵
                                                                                                                        PID:4428
                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                        find "pid:"
                                                                                                                        4⤵
                                                                                                                          PID:2452
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                                          4⤵
                                                                                                                            PID:3860
                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                            find "pid:"
                                                                                                                            4⤵
                                                                                                                              PID:3312
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Error opening svchost.exe(5144): "
                                                                                                                              4⤵
                                                                                                                                PID:2064
                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                find "pid:"
                                                                                                                                4⤵
                                                                                                                                  PID:4792
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
                                                                                                                                  4⤵
                                                                                                                                    PID:3500
                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                    find "pid:"
                                                                                                                                    4⤵
                                                                                                                                      PID:2580
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\PSCC.bat""
                                                                                                                                    3⤵
                                                                                                                                      PID:5000
                                                                                                                                    • C:\Program Files\ugeeTablet\64\devcon.exe
                                                                                                                                      "C:\Program Files\ugeeTablet\64\devcon.exe" install vmulti.inf pentablet\hid
                                                                                                                                      3⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2824
                                                                                                                                    • C:\Program Files\ugeeTablet\driver\64\dpinst.exe
                                                                                                                                      "C:\Program Files\ugeeTablet\driver\64\dpinst.exe" /sw /se /f /lm /sa
                                                                                                                                      3⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:5352
                                                                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                                                                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d1217cde-0cb2-e448-8a80-e8de7d8cd12f}\vmulti.inf" "9" "4b1fe2f8b" "000000000000016C" "WinSta0\Default" "00000000000000DC" "208" "c:\program files\ugeetablet\64"
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  PID:5628
                                                                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                                                                  DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_59cd3ca53d111513\vmulti.inf" "oem1.inf:b2fe4818b67bbc5d:vmulti.Inst.Win7:6.1.7600.16385:pentablet\hid," "4b1fe2f8b" "000000000000016C" "e4c1"
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3000
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k PenService -s PenService
                                                                                                                                  1⤵
                                                                                                                                    PID:1432
                                                                                                                                  • C:\Windows\system32\ctfmon.exe
                                                                                                                                    /QuitInfo:00000000000002C0;00000000000002C4;
                                                                                                                                    1⤵
                                                                                                                                      PID:5412
                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{59da7e6b-47f2-cc46-8fc1-52b41304e798}\hanvonugeemfilter.inf" "9" "4b6d32663" "0000000000000168" "WinSta0\Default" "000000000000016C" "208" "c:\program files\ugeetablet\driver\64"
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      PID:4484
                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                      DrvInst.exe "2" "211" "HID\HID&COL01\1&2D595CA7&0&0000" "C:\Windows\System32\DriverStore\FileRepository\hanvonugeemfilter.inf_amd64_5e728e9b55a6391e\hanvonugeemfilter.inf" "oem2.inf:ed86ca113d4f58de:hanvonugeemfilter:14.27.40.873:hid\hid&col01," "4f79199e7" "0000000000000168" "e4c1"
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:3584
                                                                                                                                    • C:\Windows\system32\ctfmon.exe
                                                                                                                                      /QuitInfo:00000000000002C4;00000000000002C0;
                                                                                                                                      1⤵
                                                                                                                                        PID:5584
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:00000000000002C0;00000000000002C4;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:1336
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:000000000000022C;0000000000000204;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:6016
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:0000000000000204;000000000000022C;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:3168
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:000000000000022C;0000000000000204;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:5600
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:0000000000000204;000000000000022C;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:2408
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:00000000000002C4;00000000000002D0;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:6080
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:00000000000002D0;00000000000002C4;
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:1964
                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                        "LogonUI.exe" /flags:0x4 /state0:0xa39c0855 /state1:0x41c64e6d
                                                                                                                                        1⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:5504
                                                                                                                                      • C:\Windows\system32\ctfmon.exe
                                                                                                                                        /QuitInfo:0000000000000268;000000000000026C;
                                                                                                                                        1⤵
                                                                                                                                          PID:5148
                                                                                                                                        • C:\Windows\system32\ctfmon.exe
                                                                                                                                          /QuitInfo:0000000000000204;000000000000022C;
                                                                                                                                          1⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:2528
                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                          C:\Windows\System32\svchost.exe -k CameraMonitor
                                                                                                                                          1⤵
                                                                                                                                            PID:5072

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                devcon.exe
                                                                                                                                                • Path C:\Program Files\ugeeTablet\64\devcon.exe
                                                                                                                                                • Size 88KB
                                                                                                                                                • SHA256 0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vmulti.inf
                                                                                                                                                • Path C:\Program Files\ugeeTablet\64\vmulti.inf
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 9629db039637ba3967ef9dfe731956cfa06fb1607ce0aef4b32c22449fae2f9b
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Ugee_Tablet.xml
                                                                                                                                                • Path C:\Program Files\ugeeTablet\config\Ugee_Tablet.xml
                                                                                                                                                • Size 71KB
                                                                                                                                                • SHA256 75c2b7c464ff1a615e85b0a0439e8202839b039f2e0f5e2d3876471c2a451d3d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                language.ini
                                                                                                                                                • Path C:\Program Files\ugeeTablet\config\language.ini
                                                                                                                                                • Size 118KB
                                                                                                                                                • SHA256 f89bbf58f878386f508123421004ae2f24f28914125d41769d5f31ba7e70aa2f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                name_config.ini
                                                                                                                                                • Path C:\Program Files\ugeeTablet\config\name_config.ini
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 2f6f190030667194bee3ec0617823955e1f12de10fa3e9fe58f79e3e08f3c044
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dpinst.exe
                                                                                                                                                • Path C:\Program Files\ugeeTablet\driver\64\dpinst.exe
                                                                                                                                                • Size 1.0MB
                                                                                                                                                • SHA256 181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ugeeTablet.exe
                                                                                                                                                • Path C:\Program Files\ugeeTablet\ugeeTablet.exe
                                                                                                                                                • Size 877KB
                                                                                                                                                • SHA256 b576837ba65afb3ac7bb5e65a2d9c9d038f89f5408825d92e07e92749580c9b9
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                CheckBox.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\CheckBox.png
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 661e59fcaff2bd537b8beb7b2aa41acdd9dd1dd8a01653c86c3a3919c6eb5fb3
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                CheckBox2.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\CheckBox2.png
                                                                                                                                                • Size 704B
                                                                                                                                                • SHA256 ff820e1993e7739c982600c26efb7d39612de5ab3fe312502b8e20be1fe1d215
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                EndWintab.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\EndWintab.bat
                                                                                                                                                • Size 482B
                                                                                                                                                • SHA256 d9fa3ad5a5385b7b5bdd1c314e06983ba324421bc72e595f820daa32882543ca
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Listdlls.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\Listdlls.exe
                                                                                                                                                • Size 414KB
                                                                                                                                                • SHA256 b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Listdlls64.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\Listdlls64.exe
                                                                                                                                                • Size 215KB
                                                                                                                                                • SHA256 29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                PSCC.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\PSCC.bat
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 080a7566cd8bb25f32c3de59a62ad51801663695012ddb3376a2fe159078b24d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                UserFileImg.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\UserFileImg.png
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 4748e7944c7d592cf4036c9552c3995baf232be1f4f467df551b8a595a9a2cc2
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                bg1.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\bg1.png
                                                                                                                                                • Size 120KB
                                                                                                                                                • SHA256 df75e2e915417b5e22f58445957923cb9f033360f0e22b781d5a8cd1d9551b36
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                bg2.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\bg2.png
                                                                                                                                                • Size 91KB
                                                                                                                                                • SHA256 d786efcc5b9c06a7d34a76f169bc82f4b99b6eec8e762c2976f782e9af272546
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                botva2.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\botva2.dll
                                                                                                                                                • Size 35KB
                                                                                                                                                • SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                cancel.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\cancel.png
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 73e1957b7cf406baf9bef48a15ee4e4f989b83c385d4fbf79c9b71b1607f4646
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                close.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\close.png
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 8229ff3a3c85ba3b29ae85c97a72e79b0f9a6c3ab63d4a072ab13dc77b350e4c
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                innocallback.dll
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\innocallback.dll
                                                                                                                                                • Size 63KB
                                                                                                                                                • SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                loading.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\loading.png
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 7d7dc4f314a8b343f1b4e378bb6e29db5f6d2dfaf90d0b757a7f8da5e4def54f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                loadingbase.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\loadingbase.png
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 f97e5bf2b286ef19229a9cd04ed2a72301f689e0fffc5c6b14837ccd0a6ab4b3
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                min.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\min.png
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 72fffd6291bbd2db6828f914f094e398776a42f44a09fa1928e98d9f7bc4e419
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                next.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\next.png
                                                                                                                                                • Size 400B
                                                                                                                                                • SHA256 5d9627edd25bcdcd5da141414f9e4bddc432e276a74d6fddedfa41bbe45b9d4a
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sure.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\sure.png
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 7165d2dc8dc1caf4f2bf3ee52b7fc23abd1fed07f2b0174d14666fbf675a0d4c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                yl.png
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-3OA5I.tmp\yl.png
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 1877b8d0f8beea3e80e05f477d96e95fb2f9beb4e16f492f6ba59b40f2ebe5e2
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                UGEEWin_4.3.6.250305.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-NB88N.tmp\UGEEWin_4.3.6.250305.tmp
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 497c4c41d8acee76ae0224018ad4fd778c2722a1cc0904685a6b9a07dfb91396
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                PSUserConfig.txt
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\Adobe Photoshop CC 2017 Settings\PSUserConfig.txt
                                                                                                                                                • Size 35B
                                                                                                                                                • SHA256 d95d8a57a9b4b3f91e84aab71a9ba4a46d0cb38f7ad61611fb5058becd275497
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                dberr.txt
                                                                                                                                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                                                                                                                                • Size 75KB
                                                                                                                                                • SHA256 3e22954b4bfbf300cb64fe0ea6195df481005c7487fc8aefef11cd3651f9d620
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dberr.txt
                                                                                                                                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                                                                                                                                • Size 75KB
                                                                                                                                                • SHA256 e05fdba5647ac18fcf265cdb448c954182d92896d84c4fa3296ca49ab0e7f9ad
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hanvonugeemfilter.inf_amd64_5e728e9b55a6391e.ini
                                                                                                                                                • Path C:\Windows\System32\DriverStore\FileRepository\hanvonugeemfilter.inf_amd64_5e728e9b55a6391e.ini
                                                                                                                                                • Size 582B
                                                                                                                                                • SHA256 6fa6109a8cf37b7b78731ccda4689d3b0b6bba8e313ff7a6c82f114c90222690
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vmulti.inf_amd64_59cd3ca53d111513.ini
                                                                                                                                                • Path C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_59cd3ca53d111513.ini
                                                                                                                                                • Size 657B
                                                                                                                                                • SHA256 952f7f9ed3e03ff3dd38b99129d58f0af060180a221f5d895df8e20e3dd6982e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                WinTab32.dll
                                                                                                                                                • Path C:\Windows\System32\WinTab32.dll
                                                                                                                                                • Size 143KB
                                                                                                                                                • SHA256 e1dd90ba8fd6885f41e427168bd3c4c52c41246993aa707429ded2763ac2c782
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                WDFCOI~1.DLL
                                                                                                                                                • Path \??\c:\PROGRA~1\UGEETA~1\64\WDFCOI~1.DLL
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hidkmdf.sys
                                                                                                                                                • Path \??\c:\PROGRA~1\UGEETA~1\64\hidkmdf.sys
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                vmulti.sys
                                                                                                                                                • Path \??\c:\PROGRA~1\UGEETA~1\64\vmulti.sys
                                                                                                                                                • Size 10KB
                                                                                                                                                • SHA256 e06b47f3302da9b1509897844a9727ab6761911cc5c5e0ea06857351a1487f03
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                HANVON~1.CAT
                                                                                                                                                • Path \??\c:\PROGRA~1\UGEETA~1\driver\64\HANVON~1.CAT
                                                                                                                                                • Size 10KB
                                                                                                                                                • SHA256 b77c9daf31df08ff29c03b26071c282f21860a69406f6f809fbf0e7793f394fa
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                HANVON~1.SYS
                                                                                                                                                • Path \??\c:\PROGRA~1\UGEETA~1\driver\64\HANVON~1.SYS
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 5b4c234d27f71931ea1ca91355ca9834a6c0cd95c1e935bfdce03b418fbee2ea
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                pentablethid.cat
                                                                                                                                                • Path \??\c:\program files\ugeetablet\64\pentablethid.cat
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 299b9662e15d753aff63a7ba0a011eb79e5cc586780f39efcbd589d5b73e2736
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hanvonugeemfilter.inf
                                                                                                                                                • Path \??\c:\program files\ugeetablet\driver\64\hanvonugeemfilter.inf
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 0ed01aafce6532ba3cd19d025bfda37f6e8a06a5ef612c423f9dfa853580900b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                memory/2780-162-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2780-342-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2780-2-0x000000000041E000-0x000000000041F000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2780-0-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-72-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-267-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-153-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-165-0x0000000003D30000-0x0000000003D45000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-26-0x0000000003D30000-0x0000000003D45000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-18-0x0000000002700000-0x000000000270E000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-263-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-154-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-287-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-8-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-164-0x0000000002700000-0x000000000270E000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-334-0x0000000003D30000-0x0000000003D45000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-333-0x0000000002700000-0x000000000270E000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-332-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-341-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5764-163-0x0000000000400000-0x00000000005AE000-memory.dmp
                                                                                                                                                Download